I would like to host a site for a friend. Is there a way to do it so that my friend can update their site on their own without me? Can I give them access to the control panel or their own FTP account?

Probably the easiest way to do this is to create a new user for them and specify this user when adding their domain (or sub-domain) to the system. This way they will have their own FTP log-in and will only ‘see’ the files related to their domain(s) when logging in.

You can also create a new WEBID for them and give this WEBID certain panel ‘privileges’, but working out exactly which privileges your friend needs can be a little difficult, as many of the privileges are inter-dependent. More info on WEBID privileges can be found in the wiki article linked below;

Creating a user and giving the details to someone only allows them to log-in via FTP (and SSH if enabled).

Do I need to create a WebID for him?

Yes, if you want them to access the panel. Remember to set the appropriate panel privileges to restrict what they can do with their new WEBID. For example, you might want to restrict their activities to their own domain.